Analysis
-
max time kernel
111s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19-11-2024 02:20
Behavioral task
behavioral1
Sample
d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe
Resource
win10v2004-20241007-en
General
-
Target
d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe
-
Size
825KB
-
MD5
fab0e0e642273110c6b49d8c89c44f10
-
SHA1
9ab889c59206105590f02f07211ccb45dea20f20
-
SHA256
d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274
-
SHA512
92ddc88b6005da878e80baa9a4b8bc653c2ae7a7a8d5ab1b8753728f3c7389bc627dcbed9f022d109c05a84ba13b408d88a2aa633f976ae6acf304201fc93c9a
-
SSDEEP
12288:xMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9vSlNaK:xnsJ39LyjbJkQFMhmC+6GD9Ox
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Executes dropped EXE 3 IoCs
pid Process 2764 ._cache_d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe 2896 Synaptics.exe 2568 ._cache_Synaptics.exe -
Loads dropped DLL 5 IoCs
pid Process 1892 d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe 1892 d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe 1892 d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe 2896 Synaptics.exe 2896 Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2992 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2992 EXCEL.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1892 wrote to memory of 2764 1892 d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe 30 PID 1892 wrote to memory of 2764 1892 d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe 30 PID 1892 wrote to memory of 2764 1892 d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe 30 PID 1892 wrote to memory of 2764 1892 d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe 30 PID 1892 wrote to memory of 2896 1892 d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe 31 PID 1892 wrote to memory of 2896 1892 d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe 31 PID 1892 wrote to memory of 2896 1892 d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe 31 PID 1892 wrote to memory of 2896 1892 d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe 31 PID 2896 wrote to memory of 2568 2896 Synaptics.exe 32 PID 2896 wrote to memory of 2568 2896 Synaptics.exe 32 PID 2896 wrote to memory of 2568 2896 Synaptics.exe 32 PID 2896 wrote to memory of 2568 2896 Synaptics.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe"C:\Users\Admin\AppData\Local\Temp\d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\._cache_d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe"C:\Users\Admin\AppData\Local\Temp\._cache_d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe"2⤵
- Executes dropped EXE
PID:2764
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
PID:2568
-
-
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2992
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
825KB
MD5fab0e0e642273110c6b49d8c89c44f10
SHA19ab889c59206105590f02f07211ccb45dea20f20
SHA256d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274
SHA51292ddc88b6005da878e80baa9a4b8bc653c2ae7a7a8d5ab1b8753728f3c7389bc627dcbed9f022d109c05a84ba13b408d88a2aa633f976ae6acf304201fc93c9a
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
\Users\Admin\AppData\Local\Temp\._cache_d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe
Filesize71KB
MD5ff7e74f75177cb86a1e6a1fcbab16ce2
SHA17f7a1a24243e236095752e6e62be1ebf6ccca64d
SHA25654eb9d6eee1124ddbd772cd07daf266f69ed341e41eac74d4222d39ca19e9df8
SHA51231ebe9d976ec93b03018b85911b3a97918c11945fa4a2e1e5a93d143cd9d93efeb93966d1a3edbaea740a29297b7a8319d00e91b35e873e8857b5ff2c24bc21c